Abstract: Authentication has become integral part of 90% of web sites. The major issue in web authentication is the limitation of human memory to remember the password string for longer period. Almost all websites are still using traditional recall-based textual password to identify their remote users. Vulnerability of this authentication mechanism due to the sophistication of online identity theft has led to the increased scope for the studies of recognition-based web authentication. This paper discusses the web authentication using graphical password built over the virtual environment. It examines the security threats associated with poor authentication practices of the Web and why is the need for businesses to strengthen web authentication. The paper also proposes a new approach for delivering one-time passwords using mobile phones.